Sr. Application Security Engineer

SentinelOne is an AI-native cybersecurity company that provides autonomous protection across endpoint, cloud, identity, data, and AI systems. The Senior Application Security Engineer will support customer engagements, review and validate agentic code-scanning findings, conduct deep source-code assessments, present technical risks, develop SAST rules, and provide remediation guidance.

Responsibilities:

• Support Wayfinder Frontier AI Services customer engagements end-to-end, scope the work, deliver the technical findings, and present results to executive and technical stakeholders
• Review and triage findings from our agentic code scanning pipeline against customer C, C++, Rust, and Java codebases; validate true positives, eliminate noise, and ensure every finding that reaches the customer is a decision they can act on
• Conduct deep code review across C, C++, Rust, and Java code and common frameworks
• Present findings to stakeholders, translate technical risk into business impact, and map exposures into end-to-end exploitation chains
• Author and maintain SAST rule packs that scale across the customer base, and partner with our AI/ML engineers to improve our agentic scanning engine
• Provide expert remediation guidance to customer development teams and validate fixes through follow-up review
• Work closely with our engineering teams to enhance our agentic code scanning pipeline and reduce false positives
• Collaborate with team members and software-focused threat hunters to elevate team technical standards

Requirements:

• 5+ years in application security or product security with a strong software development background
• A proven track record translating complex findings into technical and executive-level debriefs; excellent written and verbal communication is essential
• Experience delivering customer-facing or consulting-style engagements end-to-end, comfortable in a distributed remote organization
• Proficiency in at least two of C, C++, Rust, and Java, having previously identified and explained vulnerabilities at the framework level, not just the application level
• Proficiency in at least two of C, C++, Rust, and Java, with a strong understanding of vulnerabilities and secure coding methodologies
• Strong knowledge of OWASP Top 10, CWE Top 25, and modern authentication infrastructure (SAML, OAuth, OIDC, JWT internals); experience driving an application through ASVS Level 4 verification is a plus
• Hands-on experience authoring custom static-analysis rules and queries for modern SAST engines; familiarity with AI-assisted code review workflows and validating findings produced by automated and agentic analysis pipelines
• Strong threat modeling experience throughout the secure SDLC
• Fluency with Git-based source control and CI/CD pipelines, including build-pipeline security controls, runner hardening, and release-gate enforcement
• Experience with AI-accelerated development or code scanning methodologies
• Working depth in Python (Django/Flask) and Node.js (Express) for cross-language reviews
• Reverse engineering of compiled C, C++, Rust, Java (IDA Pro, Binary Ninja, Ghidra)
• OSWE, CSSLP, GWAPT, published CVEs, or conference talks
• Familiarity with SOC 2, ISO 27001, or FedRAMP control mapping